Privacy notice

Controller and scope

Curlity is the service name, operated from Republic of Ireland. Vanbutlr Coaching is the coaching offered in Curlity. The operator is the controller of your information. Contact: vanbutlr@gmail.com. This notice explains processing; reading or accepting it is not consent.

This notice covers the app features made available to you. Some features are prepared for release and are not yet available. Provider choices are specific to the feature; general terms acceptance is not permission for external AI processing.

Information and purposes

Account and security information includes your email, sign-in identifiers, profile, protected eligibility decision, agreement versions and server-recorded times. We use it to administer accounts, enforce eligibility and document choices. We avoid collecting identity documents by default. Age declarations are not verified identity.

With separate explicit health-data consent, health-dependent features use measurements, food and training records, screening answers, coaching messages, goals and optional private media. Authorised coaching staff have role-based access; the current system is not restricted to one assigned coach. Sharing your food diary and body measurements with coaching each has its own setting, off until you turn it on. We do not use this consent to authorise advertising reuse or optional external AI processing.

The meal planner, where your membership includes it, keeps the days and meals you choose to plan, any diet, allergens and foods you leave out, your cooking time, how many people you cook for, the meals you mark to have again or not, your planned weeks and your shopping ticks. We treat allergens and diet as health information under the same explicit consent. Portions, nutrition and shopping lists are calculated on your phone from checked ingredient records, without AI. A planned meal enters your food diary only when you confirm it, and only your own portion. Leaving out an allergen never means a meal is safe for you: always check labels. Your plans stay available to read and delete if your membership ends.

Purchase records, identifiers and entitlement status support payment verification, restoration, renewals and refunds. Apple, Google or Stripe handles payment details. Support information is used to resolve your request. General app operation, contract administration, legal duties and proportionate security have their relevant legal bases; health-data processing uses explicit consent where required by Article 9, with an appropriate Article 6 basis. Optional external processing uses separate consent.

AI and translation choices

Optional AI features use OpenAI’s GPT-6 Luna model. Label scanning sends the label photo you take or choose; meal estimates send the meal photo and description you choose; monthly highlights send calculated progress facts; coach-review drafting sends relevant profile, messages, check-ins, measurements, goals, adjustments and training/nutrition records, excluding photos and videos. DeepL translates selected coaching text and relevant service communications. Each purpose has its own permission. Manual entry, original text and manual reviews remain alternatives.

A permission you gave to an earlier AI provider does not authorise OpenAI processing, so the app asks again before anything is sent to OpenAI. Coach-review drafts for members without the new permission are written manually.

OpenAI processes this information for Curlity as a processor. We ask OpenAI not to store responses, and OpenAI does not use API data to train its models. OpenAI may keep request data for up to 30 days to detect abuse, or longer where the law requires it. Provider responses may be inaccurate. Temporary scan processing does not delete your original library image or recall information already sent. Declining or withdrawing prevents new sends for that purpose but cannot recall an in-flight request.

Providers and international transfers

Supabase provides authentication, database, private storage and backend functions. Apple/Google and RevenueCat support enabled store purchases; Stripe supports existing website billing. Expo, APNs and FCM deliver enabled phone notifications. Open Food Facts receives barcode lookup requests and ordinary connection metadata. OpenAI (contracting through OpenAI Ireland Ltd, with processing by OpenAI affiliates and subprocessors, including in the United States) and DeepL are the external processors for the optional features described above.

The website uses Vercel hosting/performance tools, Resend service email and Google/Gmail support email. Coach Telegram alerts can contain your email address, message text and summaries of check-ins or coaching activity. These differ from brief phone push notifications. The website privacy notice also describes browser identifiers and conversion events; these are not all anonymous or strictly necessary.

Providers and subprocessors may process or access information outside the EEA. A restricted transfer requires an applicable adequacy decision or appropriate contractual safeguards and any necessary additional measures. An EU database does not mean all processing stays in Europe. Contact us for information about the arrangements and a copy of available safeguards. General terms acceptance is not consent to an unrestricted transfer.

Transfers to OpenAI in the United States rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses in OpenAI’s data processing addendum.

Private progress photos and form clips use authorised storage and short-lived access links. These links can still be forwarded; no system guarantees perfect security. Share only what is needed for the requested review. Private upload acknowledgement is saved once per purpose/version, while every upload remains your choice.

A public lift submission deliberately shares your handle, lift, bodyweight, performance and video. Website submissions publish after upload without individual prior approval. App submissions stay private until a coach has watched the clip and approved it; clips are not sent to an AI provider. Public sharing needs its own permission; withdrawal or removal cannot guarantee deletion of copies others made independently.

Retention and deletion

Retention depends on the purpose, sensitivity, whether the service remains active, unresolved support or legal claims, and legal recordkeeping duties. We review records when their purpose ends or you request deletion. Health screening answers, safety acknowledgements and agreement records may be kept for as long as a legal claim could be brought; for someone under 18, that period starts at their 18th birthday. We do not promise deletion of every provider copy, backup or legally required transaction record within 30 days. Phone notification jobs use 90-day inbox/delivery retention and stop sending to stale registrations after 30 days; inactive device records are removed after 90 days.

Request account deletion in Account → Privacy and data or through support, including while access is restricted. A queued request is not completed deletion. We verify requests proportionately and confirm fulfilment. Necessary transaction or legal-claim evidence may be retained for the applicable lawful purpose and period; backup handling must follow the verified deletion process.

The existing website can schedule deletion of a coaching-only account after cancellation and entitlement expiry. Keep an export of information you need before the paid period ends or contact support for help. An underage decision itself does not delete information. Store cancellation is separate from account deletion. Ask support for an export or help resolving an affected purchase.

Your choices and rights

Withdraw health permission or an optional AI permission in Account → Privacy and data. Health-dependent processing pauses without blocking support, billing, deletion or general material. Withdrawal is not consent to retaining everything indefinitely; ask about existing records and affected paid services. Marketing is optional and separate, with its own opt-out.

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to legitimate-interest processing and direct marketing. We normally respond within one month, explaining any lawful extension within that period. Requests are normally free. You may complain to the relevant supervisory authority, including Ireland’s Data Protection Commission or your local authority, without first completing our complaints process.

Security, age and updates

We use access controls, private storage and encrypted connections. No service can guarantee perfect security. The ordinary account route is 18+. Ages 16–17 can use Free under the Free terms for 16 and 17 year olds, which they agree to themselves: we keep their date of birth and the version and time of that agreement, use their information only to run the account with the under-18 settings fixed, and never for marketing or advertising. A separate, reviewed route is available for ages 16–17 under the teen participation terms for the Program and Coaching; under-16s are not eligible. If an ineligible child has an account, contact support so we can restrict access, review the information and purchase, and handle data lawfully without an automatic deletion solely because of age. Do not send identity documents unless we explain a necessary, secure process.

We date and explain material changes. A new purpose requiring consent needs a new choice before processing. Routine workouts, programme adjustments, reinstalling and changing device do not renew consent. Account records, rather than device flags, determine accepted agreement versions.

Creator codes

If you add a creator code, we store which code you used, where and when, and link your purchases to it for 60 days so the partner can be paid. Partners see only dates, products and amounts, never who bought. Supabase stores the record. Codes are not used with under-18s.

Email updates

Email updates are optional and separate from every agreement, and nobody under 18 can choose them. If you say yes, we store your choice, the exact wording you agreed to, where you chose it and when, and send occasional emails about new programmes, training tips and offers. Supabase stores the record and Resend delivers the emails.

Turn them off in Notifications or with the unsubscribe link in any email. We keep a record of each choice as proof of consent while your account exists. Email updates never use your health, food or training records.

Waitlist and giveaway information

The optional app waitlist stores your email, phone platform, coaching interest, adult confirmation and the time and wording of email consent. Supabase stores the record and Resend delivers confirmation and launch emails. Coaching interest is not separate marketing consent. Unsubscribe in either email; limited suppression and delivery records prevent repeat messages. Salted network-address hashes limit abuse and expire after a day of inactivity.

Giveaway administration uses your account ID, selected social platform and username, entry time and age/follow/comment confirmations. Selected usernames and profile links go to the existing private coach Telegram chat for eligibility checking. Resend delivers winner emails; winning usernames may be announced on @vanbutlr. Giveaway entry and stored notification records are deleted 60 days after closing; a minimal zero-price Program grant remains to maintain the prize entitlement. Copies delivered to email or Telegram follow those services’ retention settings. Waitlist consent is separate and does not affect your chance of winning.